Attempt to fix waf limit exceeded error

[falila]

No description provided.

[github-actions]

⚠ Terrform update available

Terraform: 1.5.3 (using 1.4.2)
Terragrunt: 0.48.3 (using 0.46.3)

[github-actions]

Staging: load_balancer

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 1 to add, 1 to change, 0 to destroy

Show summary

CHANGE	NAME
update	aws_wafv2_web_acl.forms_acl
add	aws_wafv2_regex_pattern_set.valid_app_uri_paths

Show plan

Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # aws_wafv2_regex_pattern_set.valid_app_uri_paths will be created
  + resource "aws_wafv2_regex_pattern_set" "valid_app_uri_paths" {
      + arn         = (known after apply)
      + description = "Regex to match the app valid urls"
      + id          = (known after apply)
      + lock_token  = (known after apply)
      + name        = "valid_app_uri_paths"
      + scope       = "REGIONAL"
      + tags_all    = (known after apply)

      + regular_expression {
          + regex_string = "^\\/(?:en|fr)?\\/?(?:(admin|id|api|auth|signup|myforms|unsupported-browser|terms-of-use|404)(?:\\/[\\w-]+))?\\/?$"
        }
      + regular_expression {
          + regex_string = "^\\/(?:en|fr)?\\/?(?:(form-builder|sla|unlock-publishing|terms-and-conditions|javascript-disabled)(?:\\/[\\w-]+))?\\/?$"
        }
      + regular_expression {
          + regex_string = "^\\/(?:en|fr)?\\/?(?:(static|_next|img|favicon\\.ico)(?:\\/[\\w-]+))?\\/?$"
        }
      + regular_expression {
          + regex_string = "^\\/(?:en|fr)?\\/?(?:\\/[\\w-]+)?\\/?$"
        }
    }

  # aws_wafv2_web_acl.forms_acl will be updated in-place
  ~ resource "aws_wafv2_web_acl" "forms_acl" {
        id         = "e8fc1b67-9d4d-4a29-8c94-65b37b30a231"
        name       = "GCForms"
        tags       = {
            "CostCentre" = "forms-platform-staging"
            "Terraform"  = "true"
        }
        # (5 unchanged attributes hidden)

      - rule {
          - name     = "TemporaryTokenGeneratedOutsideCanada" -> null
          - priority = 6 -> null

          - action {
              - count {
                }
            }

          - statement {
              - and_statement {
                  - statement {
                      - not_statement {
                          - statement {
                              - geo_match_statement {
                                  - country_codes = [
                                      - "CA",
                                    ] -> null
                                }
                            }
                        }
                    }
                  - statement {
                      - byte_match_statement {
                          - positional_constraint = "CONTAINS" -> null
                          - search_string         = "/api/token/temporary" -> null

                          - field_to_match {
                              - uri_path {}
                            }

                          - text_transformation {
                              - priority = 1 -> null
                              - type     = "COMPRESS_WHITE_SPACE" -> null
                            }
                          - text_transformation {
                              - priority = 2 -> null
                              - type     = "LOWERCASE" -> null
                            }
                        }
                    }
                }
            }

          - visibility_config {
              - cloudwatch_metrics_enabled = true -> null
              - metric_name                = "TemporaryTokenGeneratedOutsideCanada" -> null
              - sampled_requests_enabled   = true -> null
            }
        }
      + rule {
          + name     = "AllowOnlyAppUrls"
          + priority = 3

          + action {
              + block {
                }
            }

          + statement {
              + not_statement {
                  + statement {
                      + regex_pattern_set_reference_statement {
                          + arn = (known after apply)

                          + field_to_match {
                              + uri_path {}
                            }

                          + text_transformation {
                              + priority = 1
                              + type     = "COMPRESS_WHITE_SPACE"
                            }
                          + text_transformation {
                              + priority = 2
                              + type     = "LOWERCASE"
                            }
                        }
                    }
                }
            }

          + visibility_config {
              + cloudwatch_metrics_enabled = true
              + metric_name                = "AllowOnlyAppUrls"
              + sampled_requests_enabled   = false
            }
        }

        # (7 unchanged blocks hidden)
    }

Plan: 1 to add, 1 to change, 0 to destroy.

Warning: Argument is deprecated

  with aws_s3_bucket.firehose_waf_logs,
  on kinesis.tf line 30, in resource "aws_s3_bucket" "firehose_waf_logs":
  30: resource "aws_s3_bucket" "firehose_waf_logs" {

Use the aws_s3_bucket_server_side_encryption_configuration resource instead

(and 5 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_wafv2_regex_pattern_set.valid_app_uri_paths"]

18 tests, 17 passed, 1 warning, 0 failures, 0 exceptions

[bryan-robitaille]

Nice :)